Implemented proper password hashing

* Changed hash function from identity to SHA256
* Generate unique salt per-user on every password update
* Create file to convert database to new format, including hashing old
passwords.
Fixed bad logic in password hashing

Was hashing hashed password and checking against entered password in
User.login.